accel-ppp.git/accel-pppd/ctrl, branch sstp-ppposeq

sstp: add ppposeq transport to avoid userspace HDLC framing

2026-08-02T20:06:01+00:00

A pty is a byte stream, so the tty flip buffer merges frames written back to back and sstp has to re-delimit them with async HDLC escaping and a CRC-16 FCS. On a 1452-byte payload that is ~3600 ns per frame, most of it spent on the FCS. PPPOSEQ is a pppox protocol whose socket is the ppp endpoint itself, so one datagram is one frame and no framing is needed at all. The same payload takes ~380 ns per frame, about 9 times less. Requires kernel 2.6.37, the first with PX_MAX_PROTO 3, whose remaining slot it claims. Supported kernels are from 2.6.37 to 7.2. The new ppp-mode option selects the transport; auto, the default, falls back to async when the module is unavailable, so hosts with prebuilt kernels are unaffected. PPP_SYNC is removed, being disabled and unfixable over a pty: frame boundaries cannot be recovered from the stream, and coalescing cannot be prevented since frames arrive from the network stack.

sstp: enforce standard http replies w/o body

2026-08-02T15:08:11+00:00

fixes http client warnings (curl): < HTTP/1.1 404 Not Found < Date: Sun, 02 Aug 2026 14:05:21 GMT * no chunk, no close, no size. Assume close to signal end

sstp: flush queued output on disconnect

2026-08-02T14:36:00+00:00

Drain out_queue to the stream in sstp_disconnect before closing, so a queued response is sent before the connection is torn down. Best-effort, non-blocking, via a sstp_flush() helper that mirrors sstp_write. Fixes: 635ab1b7

Revert "Fixes the issue #124 HTTP replay for non SSTP query"

2026-08-02T14:36:00+00:00

Reverts 635ab1b7, e7a03684, 382b02b6, 4fbba471 on accel-pppd/ctrl/sstp/sstp.c: - http_send_response: sstp_send(buf) || sstp_write(&hnd) -> sstp_send(buf) - http_handler: drop the r/return 1 path - sstp_read: drop else if (n > 0) return 1 - remove the sstp_write forward decl

sstp: express escape buffer bound as one invariant

2026-07-26T08:19:24+00:00

(size + PPP_FCSLEN) * 2 + 2 equals 8b781b94's size*2 + 2 + PPP_FCSLEN*2 but can't collapse back to the 1801847a under-allocating form.

ipoe: fix username string leak on early session teardown

2026-07-06T22:15:06+00:00

The ipoe-level ses->username always holds an allocated string (_strdup of ifname/calling-station-id, u_inet_ntoa buffer or lua result), but ipoe_session_free() never released it. Ownership is normally transferred in auth_result() via ap_session_set_username(), so the string was leaked whenever a session died before auth_result() ran: termination while starting, PWDB_WAIT never completing, or ipoe_create_interface() failure. The create-interface failure path also leaked the freshly allocated local copy outright, since it returned before the string was stored anywhere. Store the string in ses->username as soon as it is obtained and free it in ipoe_session_free(). auth_result() clears ses->username before handing ownership to ap_session_set_username(), so no double free is possible. Reported-by: Louis Scalbert (#101)

ipoe: fix dhcpv4 relay reply packet leak

2026-07-06T22:15:06+00:00

dhcpv4_relay_read() takes a reference on the reply packet for every registered listener context and hands it over via triton_context_call(). The receiving ipoe_ses_recv_dhcpv4_relay() consumes that reference by storing the packet in ses->dhcpv4_relay_reply, but the early-return branch taken when the original request is already gone dropped the reference without freeing the packet. This leaks one packet every time a relay reply races with the request being released, which happens regularly on busy relay-mode deployments. Reported-by: Louis Scalbert (#101)

pppoe: fix use-after-free in mac_filter_load()

2026-07-06T08:28:53+00:00

When a mac-filter file line contained an octet > 255, the error path freed the entry but kept writing to it and linked it into mac_list. Validate all octets before allocating so invalid lines are skipped entirely. This is not considered a security vulnerability: the mac-filter file can only be configured by an administrator with access to the daemon config, or the CLI, both of which require privileged access. Fixes #307 Signed-off-by: Denys Fedoryshchenko

Merge pull request #323 from nuclearcat/stability-fixes

2026-06-23T15:58:26+00:00

Stability fixes

Merge pull request #315 from nuclearcat/khedor-fixes

2026-06-23T15:33:09+00:00

Several bugfixes for problems reported by Khodor Tahech